Payments in the production environment must always take place from the same e-shop URL address that was registered and approved for the business account.
The payments created will then be assigned to this URL address according to the production credentials assigned.
💡 GoPay tip: Are you changing the URL address of an e-shop that is already registered, or do you want to
connect GoPay to a completely new e-shop? Follow the instructions here or write to us at podpora@gopay.cz.
The registered e-shop must meet the Requirements for a merchant outlet.
Example: you have the URL address "nazev-eshopu.xy" registered and approved, so payments can only be created from the URL address "nazev-eshopu.xy".
Subdomains of the registered URL address are an exception, e.g. "druhy-nazev.nazev-eshopu.xy", provided the payments are for the sale of the same products or services as at the approved URL address "nazev-eshopu.xy".
Summary:
Payments in the production environment must always take place from the same e-shop URL address that was registered for the business account.
What about reservation systems?
For those, it is acceptable for payments to take place from a registered e-shop URL in the form nazev-eshopu.rezervacni-reseni.xy (e.g. https://gopay.gopayrezervace.cz)
When creating the payment you also have to pass the same URL as the return URL (the return_url parameter in the callback object), with the option, of course, of adding further parameters / targeting after the slash.
Example: nazev-eshopu.rezervacni-reseni.xy/rekapitulace-objednavky(e.g. https://gopay.gopayrezervace.cz/return/order123).
The WWW prefix has no effect on the above, so it does not matter whether the registered e-shop is without www, https://nazev-eshopu.xy, or with www,https://www.nazev-eshopu.xy.
At the same time you always have to pass the URL of the merchant outlet (nazev-eshopu.rezervacni-reseni.xy, or nazev-eshopu.xy) that you registered with us for processing payments in the order_description parameter. You pass the order_description parameter according to our technical documentation when creating the payment in the body of the request.
As an alternative to the order_description parameter, you can pass an order item containing the url in the item object, in the name andproduct_url parameters.
Summary for reservation systems:
payments must take place from the registered e-shop URL
when creating the payment you also have to pass:
the same form of the registered e-shop URL in the return URL
the same form of the registered e-shop URL in the order description (the order_description parameter) OR the same form of the registered e-shop URL in an item (as the name and product_url parameters)
Example situation 1:
The registered address isgopay.cz
the payment takes place from gopay.cz – OK
the payment takes place from www.gopay.cz – OK
the payment takes place from www.gopay.com – NOT OK, because it is a different domain of the merchant outlet
the payment takes place from www.gopay.cz/neco-nekde – OK, provided the section leads to a sales page with the same products or services that were approved for the URL gopay.cz
the payment takes place from neco.gopay.cz – OK, provided the subdomain offers the same products or services that were approved for the URL gopay.cz
Example situation 2:
The merchant outlet gopay.gopayrezervace.cz is registered and uses the Gopayrezervace reservation system.
the payment takes place from gopay.gopayrezervace.cz, the return URL passed with the payment is gopay.gopayrezervace.cz/nekam-se-vracim/cilova-stranka and the order description passes gopay.gopayrezervace.cz – OK
the payment takes place from gopay.rezervacegopay.cz and the return URL passed with the payment is gopay.gopayrezervace.cz/nekam-se-vracim/cilova-stranka – NOT OK, because the payment was created from a different reservation system URL (probably within another solution that processes payments on the domain rezervacegopay.cz)
the payment takes place from gopay.gopayrezervace.cz and the return URL is vracim-se-jinam.testgopay.cz/nekam-se-vracim/cilova-stranka – NOT OK, because the return URL differs. The base URL should always match the URL the payment was created from.
the payment takes place from gopay.gopayrezervace.cz, the return URL passed with the payment is gopay.gopayrezervace.cz/nekam-se-vracim/cilova-stranka
and the order description passes Order for gopay.gopayrezervace.cz – OK, the order description passes the same URL
and further supplementary information can also be passed (in this case "Order for….")the payment takes place from gopay.gopayrezervace.cz and the return URL is gopay.gopayrezervace.cz/nekam-se-vracim/cilova-stranka
and the order description passes gopay.rezervacegopay.cz – NOT OK, because a different URL is given in the order description
Why do we do it this way?
Although the production credentials are used to create payments, despite all the precautions (sending them only to registered contacts and authorised persons) they are still data that can be misused and can fall into the hands of an unauthorised person.
With the production credentials, an unauthorised person can create payments without any control from another platform or environment, and these payments can then take place for a misleading range of goods. That can have a negative impact on the real e-shop, damage the merchant's name and deliberately burden the payment gateway system.
That is why we have specific rules for handling production credentials, namely that payments must always be created from the same URL address as the one given at registration (i.e. the URL the customer moves to the payment gateway from; technically this information can be assessed from the HTTP Referer header, if available).
In the case of a reservation system we can accept the form nazeveshopu.rezervacnisystem.xy, provided that the same URL is also passed with the payments as the return URL (see above) and that the URL is also given in the order description passed.
💡 GoPay tip: If you have any doubts or are not sure, consult our technical support at integrace@gopay.cz.
Creating payments with a static reservation system URL is not permitted and constitutes a breach of the GOPAY terms.